Question 1

When creating a BIOC rule, which XQL query can be used?

Options :

A :

dataset = xdr_data

| filter event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

B :

dataset = xdr_data

| filter event_type = PROCESS and

event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

C :

dataset = xdr_data

| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

| fields action_process_image

D :

dataset = xdr_data

| filter event_behavior = true

event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

Answer: B

Question 2

Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?

Options :

A : UASLR

B : JIT Mitigation

C : Memory Limit Heap spray check

D : DLL Security

Answer: A

Question 3

Which profiles can the user use to configure malware protection in the Cortex XDR console?

Options :

A : Malware Protection profile

B : Malware profile

C : Malware Detection profile

D : Anti-Malware profile

Answer: B

Question 4

Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

Options :

A : Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list

B : From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

C : Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

D : In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

Answer: B

Question 5

Which type of BIOC rule is currently available in Cortex XDR?

Options :

A : Threat Actor

B : Discovery

C : Network

D : Dropper

Answer: D

Higher Test Marks with Free Online PCDRA Exam Practice

Buying Options: